The Tested Application

Finish it. A suite covering your security properties, your validation and your awkward edges, at the right layer for each, with doubles only at the boundaries. A pipeline that runs it on every push and blocks a merge on failure. No flaky tests, proven by running it ten times. Then write a short document listing what you deliberately did not test and why, because a suite that claims to cover everything is less trustworthy than one that states its limits. One thing must be true before you call it done: every test in the suite has been seen to fail at least once.